{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:85c506cd-8acc-55bb-b3d6-6f01d5671322", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3", "version": "4.1.9.RELEASE-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.1.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:20046a4a-96e3-5911-8e2b-c85f28636834", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 4.1.9.RELEASE-tuxcare.2 is NOT affected by CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter). The XXE protection fix shipped in the upstream Spring Framework 4.1.9.RELEASE before TuxCare onboarding. The vulnerable pattern is not present - external entity processing is disabled by default via SAX feature configuration and a no-op entity resolve...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:03f556b6-8278-592a-978c-0624e86f18e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE vulnerability) is NOT present in Spring Framework 4.1.9.RELEASE-tuxcare.2. The upstream fix (commit 8e096aeef5, SPR-11768) was already included in the upstream 4.1.9.RELEASE release before TuxCare onboarded it. All XML processing components that handle user-provided XML (SourceHttpMessageConverter, Jaxb2Marshaller, AbstractMarshaller, Jaxb2RootElementHttpMessageConverter) contain NO_OP_ENTITY_RESOLVER defenses that return empty InputSource for entity resolution, and external entity processing is disabled by default (processExternalEntities = false). The vulnerable code pattern described in the CVE is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:32cdab0a-7c7a-50b1-a1a0-17b90bb543f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 (XSS in Spring MVC FormTag) is not present in Spring Framework 4.1.9.RELEASE. The vulnerability allowed injection of arbitrary HTML/JavaScript via unencoded request URIs in form action attributes. The fix (UriUtils.encodePath encoding) was already included in upstream release 4.1.9.RELEASE before TuxCare onboarding. Target code at FormTag.java:449-456 shows the encoding defense is...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:b8320c86-d12a-5e18-83a2-f175d1f151a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 4.1.9.RELEASE is not affected by CVE-2014-3625. The vulnerability affects versions 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2. The target version (4.1.9) is well past the fixed version (4.1.2), and analysis confirms all security defenses from the upstream fix are present in the codebase. The fix was shipped in the upstream 4.1.9.REL...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a3e458e7-a973-548c-a77b-afae59493df4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9878 affects version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:886d694c-200e-561e-bdfb-133980485e56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.1.9.RELEASE does not contain CORS support, which was introduced in version 4.2.0 (April 2015). CVE-2020-5397 is a vulnerability in CORS preflight request handling that requires the presence of CorsUtils.isPreFlightRequest() and CORS processing logic in AbstractHandlerMapping. Since the target version predates CORS support entirely, the vulnerable code is not present and the C...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:154583c4-e85f-51f4-9d32-379eec97e038", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a31b82bf-8416-500f-8d48-ef4fd9d7a79f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:448993d2-18c3-505c-97c1-f172b5a771fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:88f61944-c7d4-5e62-8610-523c93db8baa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.1.9.RELEASE does not contain the vulnerable observation/micrometer integration code that was introduced in Spring Framework 6.0.0. The vulnerability (CVE-2023-34053) affects the DefaultServerRequestObservationConvention classes which create KeyValue metric objects from HTTP method strings without validation, enabling DoS through unbounded metric cardinality. These observation...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:71700032-bbd1-5db3-bb16-2a97cd1ff579", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:5e8531a2-568d-506a-826b-025c702c754b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:c1daa27b-6f3c-5e6c-aaf5-3473411df439", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc, and is fixed in 4.1.9.RELEASE-tuxcare.4." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:4ccb8716-da80-5393-b40c-1665e328a6b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:d65249b3-c337-59bb-9c3a-4bd2ac20e4ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22735 does not affect version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. Server-sent event support was introduced in Spring Framework 4.2.0; 4.1.9.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:bbe121f6-7a2a-57a0-b020-8dc6af43fa6a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22737 does not affect version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. Script template views were introduced in Spring Framework 4.2.0; 4.1.9.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:157399d6-f3a0-52ff-8fe2-e64da85695cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:3be83038-68eb-55a0-873f-d35c08a46837", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:60fa08c5-33f9-56ce-86ce-ff9832985d24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:8e7ba797-49ca-58fa-bb90-57104effff04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:1d9d10dd-0f18-5e5f-ad93-4de997fed8b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:9ce54f71-5a7c-5ac1-8d78-958950c1f5ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:dd60f9dd-7dbe-5ea6-8fa3-6e38a6e07acf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:1bc6b532-b866-542b-9af7-549818bacb0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:7c99fb94-a7b6-50bf-9754-ab1257c94291", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:e34a7592-6678-5431-92c8-3bef7a358c1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.1.9.RELEASE does not contain UrlHandlerFilter, which was introduced in version 6.2.0-M2 (May 2024). The entire vulnerable component and its trailing-slash redirect functionality are absent from this 2015-era version. CVE-2026-47883 backports exist only for 6.2.x versions where the vulnerable class is present. No alternative mechanism in 4.1.9 exhibits the same vulnerability p...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:8e565498-40e4-50c8-a722-26a19f8fe6a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:7cc34689-2c56-5485-8ce6-0fadfcce12c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:8336653c-ced2-56cb-a606-c8697c3db96f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 4.1.9.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:f683240d-3c79-55ae-8e18-b98536ea4ffa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 4.1.9.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.1.9.RELEASE does not contain the vulnerable code. The CVE targets Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()) and SSE emitter classes (SseEmitter, ResponseBodyEmitter), which were introduced in later versions. The functional web framework was introduced in Spring 5.0 (2017), and ResponseBodyEmitter/SseEmitter were introduced in Spring 4.2 (201...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.9.RELEASE-tuxcare.3" } ] }